Forum Discussion
How to implement Device ID+ with BIG-IP ASM/AWAF
i'm able to log diA & diB using irule provided by Anulfo Hernandez
when HTTP_REQUEST {
if [HTTP::cookie exists _imp_apg_r_] {
set deviceid [URI::decode [HTTP::cookie _imp_apg_r_]]
log local0. "URL Decoded cookie is $deviceid"
set deviceida [lindex [regexp -inline -- (?:"diA":")(.*?)(?:") $deviceid] 1]
log local0. "diA = $deviceida"
set deviceidb [lindex [regexp -inline -- (?:"diB":")(.*?)(?:") $deviceid] 1]
log local0. "diB = $deviceidb"
log local0. "IP is [IP::client_addr]"
log local0. "Path os [HTTP::path]"
} else {
log local0. "No cookie"
}
}
now i want to use it with bot defense how to match on diA?
when BOTDEFENSE_ACTION {
if {[$diA equals {"[AYrQyWEAAAAACxF5RBPJyPdDICteKxbw"}]} {
set res [BOTDEFENSE::action block]
log local0. "Mohanad is Blocked"
}
}
- Daniel_WolfDec 30, 2021MVP
How do you want to identify a bot by only looking at diA? You would need to have a list of known good identifiers (maybe all devices belonging to your company?) and then make an iRule action based on this list.
Or you could store Device ID+ identifiers and build a custom solution that would, for example, rate limit this device, or block the device if it appears from different geolocations within unreasonable time (now in USA, 10 seconds later in Sweden or so).
What I want to say is, that the device identifier from DID+ does not mean anything to Bot Defense. You will have to build a custom solution and "business logic" around it.
- MohanadDec 31, 2021Cirrostratus
Thank you Daniel, You are absolutely right about build a custom solution and "business logic", i realized that DID+ not fully integrated with F5 BIGIP, all i want to test out the feature with ASM like a PoC.
- Daniel_WolfJan 03, 2022MVP
You can follow along this video of Matthieu Dierick from F5:
https://www.youtube.com/watch?v=PVYwh76nGVE&t=10s
In his Github Repo (https://github.com/MattDierick/DeviceID-api-server) you can take a closer look at his solution.
However he is using APM, not AdvWAF.
He build an API to store information about the user and the diA and diB. You can either use his API or build a similiar one with https://loopback.io/.
The big missing piece is how to store the diA and diB in this API with AdvWAF instead of APM. Be creative :)
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com